Device Independent Quantum Private Query with Finite Number of Entangled Qubits

TL;DR

This paper extends device-independent quantum private query protocols to finite qubit scenarios, linking sample size to success probability and providing a rigorous security analysis for practical implementation.

Contribution

It upgrades existing protocols to finite qubits and establishes a connection between sample size and CHSH test success probability, with a detailed security analysis.

Findings

Protocol successfully adapted for finite qubits

Sample size directly influences CHSH test success probability

Rigorous security proof provided for the finite case

Abstract

In a recent work by Maitra et al. (Phys. Rev. A, 2017), it was shown that the existing Quantum Private Query (QPQ) protocols fail to maintain the database security if the entangled states shared between Alice and Bob are not of a certain form. So it is necessary to certify the states a priori. In this regard, the local CHSH test was proposed. However, the proposed scheme works perfectly for the asymptotic case when we have infinite number of qubits. In this brief report, we upgrade the protocol for finite number of qubits and connect the sample size to the success probability of CHSH test. We also perform a rigorous security analysis of the proposed protocol.

Equations

$$\sin \theta (\sin {\psi }_1+\sin {\psi }_2)+\cos {\psi }_1-\cos {\psi }_2$$

$$(r\cos \varphi \sin {\psi }_1+r\sin \varphi \cos {\psi }_1)$$

$$\mathrm{Pr}[|p^{\prime }-p|\le ϵp]\ge 1-\gamma ,$$

$$m_{opt}=\frac{1}{2{ϵ}^2{p}_{max}^2}\ln \frac{1}{\gamma }.$$

$$p_{max}-ϵp_{max}\le p^{\prime \prime }\le p_{max}+ϵp_{max}.$$

$${ϵ}_A\le \sqrt{\frac{2ϵp_{max}}{\cos {\psi }_1}}.$$

$$Y_i=\{\begin{array}{ll}1& \text{if }{a}_i\oplus b_i=x_i\wedge y_i\\ 0& \text{if }otherwise.\end{array}$$

$${ϵ}_A^{\prime }\le \sqrt{\frac{2nϵp_{max}}{r\cos {\psi }_1}}.$$

Full text

I Introduction

Quantum private query is a two party mistrustful cryptographic primitive. In QPQ one of the two legitimate party, say Bob, owns a database. His job is to protect the entire database from the client’s (Alice’s) knowledge along with providing the element asked by the client. On other hand, the client’s motivation is to extract more elements from the database beside her query.

Giovannetti et al. GLM first proposed the idea of QPQ protocol followed by GLM11 ; Olejnik . However, their protocols were found difficult to implement in practice. With the motivation for practical implementation Jakobi et al. jakobi came out with a QPQ proposal which is based on SARG04 quantum key distribution protocol SARG . In 2012, Gao et al. Gao presented flexible QPQ protocol. Here, flexible means Bob can regulate the information of Alice about the shared key between themselves by controlling some parameters. In 2014, Yang et al. Yang proposed the entanglement version of Gao with the help of B92 QKD protocol b92 .

Any QPQ protocol deals with database security and user privacy. Database security guarantees that the protocol never leaks any element of the database to the client except the query he or she has made. On the other hand, user privacy prevents the database owner to know the query of the client. Very recently, Maitra et al. Maitra showed that if the entangled states shared between Bob and Alice are not in a specific form, then Alice can exploit a strategy by which she can extract more information than what is suggested by the protocol. In other words, if the entangled states are not in a certain form, then the database security becomes vulnerable. To resist such attack, they proposed local CHSH test Lim . Observing the outcomes of the test, they certify whether the states are suitable for further use in QPQ protocol.

For DI protocols acin06a ; acin06b ; scarani06 ; Acin involving maximally entangled state, e.g., for QKD-type protocols, the success probability of Bob has to be precisely the maximum possible, i.e., $cos^{2}\pi/8\approx 0.85$ and hence infinitely large number of qubits are required to estimate this probability. However, for the QPQ protocol, for any given $\theta$, the maximum probability may be less than $cos^{2}\pi/8$. Thus, we can reduce the number of qubits at the cost of allowing the estimated probability to deviate from the expected maximum probability by a negligible amount.

Due to the above deviation, we have to allow some information leakage to Alice. However, we show that this information leakage entirely depends on how much deviation we should accept for the test. The order of the information leakage is exactly same as the order of the deviation allowed.

In this report we follow up the work of Maitra in the motivation towards bridging the gap between theory and practice.

II Modification Towards Finite Number of Entangled States

In Maitra , it has been shown that if the entangled states shared between Bob and Alice are not in a certain form, then Alice can exploit a cleaver strategy to gain more information about the shared key than what is suggested by the protocol. Thus, to ensure the security of the QPQ protocol, it is necessary to test the shared states a priori. As Alice is considered as an adversary here, so it is Bob who tests the states. The test proposed in Maitra is actually the CHSH test performed locally with non-maximally entangled states. Under some reasonable assumptions the scheme presented in Maitra works perfectly when the numbers of the entangled states tend to infinity.

In this section, we will discuss how we can modify the protocol Maitra for the finite numbers of entangled states. Firstly, we try to estimate the number of qubits for the local CHSH test in an optimal way. By the word ‘optimal’ we want to mean that the estimated value should be the minimum number of samples required for the local CHSH test. Secondly, we show that the deviation which we have to allow to upgrade the protocol for finite sample size does not open a security loop-hole in the protocol.

II.1 Maximization of success probability

In DI-QPQ protocol Maitra , Bob and Alice share entangled states of the form $\frac{1}{\sqrt{2}}(|0\rangle_{B}|\phi_{0}\rangle_{A}+|1\rangle_{B}|\phi_{1}\rangle_{A})$, where, $|\phi_{0}\rangle_{A}=\cos{(\frac{\theta}{2})}|0\rangle+\sin{(\frac{\theta}{2})}|1\rangle$ and $|\phi_{1}\rangle_{A}=\cos{(\frac{\theta}{2})}|0\rangle-\sin{(\frac{\theta}{2})}|1\rangle$. The value of $\theta$ is known to all. Bob chooses two measurement bases namely $\{\left|\psi_{1}\right\rangle,\left|\psi_{1}^{\perp}\right\rangle\}$ and $\{\left|\psi_{2}\right\rangle,\left|\psi_{2}^{\perp}\right\rangle\}$, to play the local CHSH game. Here, $\left|\psi_{1}\right\rangle=\cos\frac{\psi_{1}}{2}\left|0\right\rangle+\sin\frac{\psi_{1}}{2}\left|1\right\rangle$ and $\left|\psi_{2}\right\rangle=\cos\frac{\psi_{2}}{2}\left|0\right\rangle+\sin\frac{\psi_{2}}{2}\left|1\right\rangle$. Now, for a particular value of the angles $\psi_{1}$, $\psi_{2}$ and $\theta$, only Bob can calculate the success probability value of the local CHSH game, hence, preventing Alice to manipulate the states and the measurement devices. Here we propose a modification of the scheme Maitra .

In the DI-QPQ protocol Maitra , Bob gets the success probability in terms of $\theta$, $\psi_{1}$ and $\psi_{2}$ which is equal to $\frac{1}{8}(\sin{\theta}(\sin\psi_{1}+\sin\psi_{2})+\cos\psi_{1}-\cos\psi_{2})+\frac{1}{2}$. To maximize the quantity, we have to maximize $\sin{\theta}(\sin\psi_{1}+\sin\psi_{2})+\cos\psi_{1}-\cos\psi_{2}$.

Now, we can write,

[TABLE]

Setting $\sin{\theta}=r\cos{\phi}$ and $1=r\sin{\phi}$, we get

[TABLE]

where $r^{2}=1+\sin^{2}{\theta}$, $r\cos{\phi}=\sin{\theta}$ and $r\sin{\phi}=1$. Thus we get, $\tan{\phi}=\mathrm{cosec}~{}{\theta}~{}$ i.e, $\phi=\tan^{-1}(\mathrm{cosec}~{}{\theta}~{})$.

Again, the value $r(\sin(\psi_{1}+\phi)+\sin(\psi_{2}-\phi))$ will be maximum when both $\sin(\psi_{1}+\phi)=1$ and $\sin(\psi_{2}-\phi)=1$ i.e, when $(\psi_{1}+\phi)=\frac{\pi}{2}$ and $(\psi_{2}-\phi)=\frac{\pi}{2}$. From that we get, $\psi_{1}=(\frac{\pi}{2}-\phi)$ and $\psi_{2}=(\frac{\pi}{2}+\phi)$.

As we know the value of $\theta$, we can easily calculate the value of $\psi_{1}$ and $\psi_{2}$ from the above equations and play the local CHSH game for these $\psi_{1}$ and $\psi_{2}$. For these values of $\psi_{1}$ and $\psi_{2}$, the success probability value corresponding to that $\theta$ will be maximum. Figure 1 shows how $p_{max}$ varies as $\theta$ varies between 0 to $\pi$, taking the maximum value of $cos^{2}\pi/8$ at $\theta=\pi/2$.

II.2 Expected estimation on the sample size

We recall the Chernoff-Hoeffding Chernoff bound here.

Proposition 1**.**

Let $X=\frac{1}{m}\sum_{i}{X_{i}}$ be the average of $m$ independent random variables $X_{1},X_{2},\cdots,X_{m}$ with values $[0,1]$, and let $\mathbb{E}[X]=\frac{1}{m}\sum_{i}{\mathbb{E}[X_{i}]}$ be the expectation value of $X$, then for any $\delta>0$, we have $\Pr\left[|X-\mathbb{E}[X]|\geq\delta\right]\leq\exp(-2\delta^{2}m).$

In our case, if the $i$-th run of the CHSH test succeeds, we set $X_{i}=1$; otherwise $X_{i}=0$. Note that $\mathbb{E}[X]=\mathbb{E}[X_{i}]=p$ (say), the expected success probability of the CHSH test. The variable $X$ denotes the actual success probability $p^{\prime}$.

Now the question is how large should “the number of samples” be so that we get a good “accuracy” of the given state with high “confidence”? More precisely, suppose we want to estimate the success probability $p$ within an error margin of $\epsilon p$ and confidence $1-\gamma$, meaning

[TABLE]

where $p^{\prime}$ and $p$ are the estimated and the expected values respectively. Comparing Equation (1) with Proposition 1, we want, for given $\epsilon$, $p$ and $\gamma$,

$\exp(-2\epsilon^{2}p^{2}m)\leq\gamma,\indent\mbox{i.e., }m\geq\frac{1}{2\epsilon^{2}p^{2}}\ln\frac{1}{\gamma}.$

This implies that as the value of the success probability increases, the required sample size decreases. Denoting the maximum success probability for a specific $\theta$ by $p_{max}$, we can write,

[TABLE]

This $m_{opt}$ gives the optimal value of the sample size required to certify the states for a given $\theta$. Figure 2 shows how $m_{opt}$ varies with $\epsilon$ and $p_{max}$, when we fix the confidence at 99%.

II.3 Security bounds against additional information leakage

Now, we will propose a bound on the value of $\epsilon$ so that exploiting this deviation, Alice can not extract significant amount of information about the key shared between Bob and herself.

In our modified version of the local CHSH test, we suggest that if the maximum success probability of the given state lies within the specified interval then Bob accepts the state and proceeds the protocol otherwise Bob aborts the protocol.

It may happen that for some other state (for example, $(\alpha|0\rangle_{B}|\phi_{0}\rangle_{A}+\beta|1\rangle_{B}|\phi_{1}\rangle_{A})$, where $|\alpha|^{2}=(\frac{1}{2}+\epsilon_{A})$ and $|\beta|^{2}=(\frac{1}{2}-\epsilon_{A})$) the success probability value lies within this interval. Now to cheat Bob, Alice may supplies a state of the above form. In this case, if Alice chooses the basis $\{|\phi_{0}\rangle_{A},|\phi_{0}^{\perp}\rangle_{A}\}$ with probability $\frac{1}{2}-\epsilon_{A}$ and $\{|\phi_{1}\rangle_{A},|\phi_{1}^{\perp}\rangle_{A}\}$ with probability $\frac{1}{2}+\epsilon_{A}$, she can extract $(\frac{1}{2}+2\epsilon_{A}^{2})\sin^{2}\theta$ fraction of entire key stream Maitra which is prohibited by the protocol.

To close such type of security loop-hole (which arises due to the finite sample size) we bound the value of $\epsilon$ so that the additional information which is leaked to Alice should be infinitesimally small.

Let, in spite of the claimed state, Bob is provided the states of the form $(\alpha|0\rangle_{B}|\phi_{0}\rangle_{A}+\beta|1\rangle_{B}|\phi_{1}\rangle_{A})$. Rigorous calculations show that the success probability for these states merges to $\frac{1}{2}+\frac{1}{8}\sin{\theta}(\sin{\psi_{1}}+\sin{\psi_{2}})+\frac{1}{4}\sqrt{\frac{1}{4}-\epsilon_{A}^{2}}(\cos{\psi_{1}}-\cos{\psi_{2}})+\frac{1}{4}\epsilon_{A}\cos{\theta}(\cos{\psi_{1}}+\cos{\psi_{2}})$. We denote this success probability value by $p^{\prime\prime}$. Now for the given state to be successfully verified, this success probability value ($p^{\prime\prime}$) must lie within the interval $[p_{max}-\epsilon p_{max},p_{max}+\epsilon p_{max}]$, where $p_{max}$ is the maximum success probability of the original claimed state for a given $\theta$ and $\epsilon$ is the accuracy parameter chosen by Bob.

So, $p^{\prime\prime}$ must satisfy

[TABLE]

Now from the left and right inequalities, we get $\epsilon_{A}^{2}\geq-\frac{2\epsilon p_{max}}{\cos{\psi_{1}}}$ and $\epsilon_{A}^{2}\leq\frac{2\epsilon p_{max}}{\cos{\psi_{1}}}$ respectively. Since negative $\epsilon_{A}$ is not meaningful, we have the solution as

[TABLE]

Here, we consider only the situation when $\psi_{1}\in[0,\frac{\pi}{2})$. This is because from the previous calculation we get that the value of $\psi_{1}$ always lies within $[0,\frac{\pi}{2})$ whenever $\theta\in[0,\frac{\pi}{2}]$.

So, to deceive Bob the states are prepared in such a way such that the value of $\epsilon_{A}$ must satisfy the condition $\epsilon_{A}\leq\sqrt{\frac{2\epsilon p_{max}}{\cos{\psi_{1}}}}$. Otherwise, with a high probability the success probability of the given state will not lie within the specified interval and Bob will abort the protocol.

From the earlier section we get that for a given $\theta$, the values of $p_{max}$, $\psi_{1}$ and $\psi_{2}$ are fixed. So, we can write $\epsilon_{A}\leq k\sqrt{\epsilon}$, where $k=\sqrt{\frac{2p_{max}}{cos\psi_{1}}}$ is a constant for a given $\theta$. In this case, Alice will get the additional information which equals to $\epsilon_{A}^{2}\sin^{2}{\theta}$ Maitra . Thus, the information leaked to Alice remains in order of $\epsilon$. If we choose the value of $\epsilon$ sufficiently small, say $10^{-10}$, then we can bound the leakage in the order of $10^{-10}$.

III Modified DI-QPQ protocol with optimal samples and Security Analysis

Now, we are in the state to propose our modified protocol for finite sample size. Bob first calculates the value of $\psi_{1}$ and $\psi_{2}$ for which the claimed state attains the maximum success probability. Then from the calculated maximum success probability $p_{max}$, Bob calculates the required optimal sample size $m_{opt}$ for the local CHSH test to certify the states with certain accuracy and confidence. Bob starts with $n=2m_{opt}$ number of entangled states (see Section III.1 for explanation). Let $\Gamma_{CHSH}$ denote the set which contains the states for local CHSH test, where $|\Gamma_{CHSH}|=m_{opt}$ and $\Gamma_{QPQ}$ denote the set which contains the remaining states, i.e., $|\Gamma_{QPQ}|=n-m_{opt}=m_{opt}$. Bob chooses the states for each of $\Gamma_{CHSH}$ and $\Gamma_{QPQ}$ uniformly at random from the given set of $n$ states. Our modified protocol has been described in Algorithm 1.

Note that the assumptions considered in Maitra also remain valid for our modified version. Explicitly, here also, we assume i) the inherent correctness of the quantum mechanics, ii) no information leakage from the legitimate parties’ laboratories, iii) devices are memoryless i.e., each use of the devices is independent and iv) the detectors have unit efficiencies.

III.1 Security Analysis of the Modified Protocol

The security analysis of the modified protocol follows from the following result (see Appendix A for proof).

Theorem 1**.**

If for a subset $\Gamma_{CHSH}$ of size $m$, the fraction of the inputs ($x_{i}$, $y_{i}$), $i\in\Gamma_{CHSH}$, which satisfy the CHSH condition i.e., $(a_{i}\oplus b_{i}=x_{i}\wedge y_{i})$ is equal to $\frac{1}{8}(\sin{\theta}(\sin\psi_{1}+\sin\psi_{2})+\cos\psi_{1}-\cos\psi_{2})+\frac{1}{2}-\delta$, then for the remaining subset $\Gamma_{QPQ}$ of size $n-m$, a fraction of inputs $(x_{i},y_{i})$, $i\in\Gamma_{QPQ}$, which satisfy the CHSH condition, is also equal to $\frac{1}{8}(\sin{\theta}(\sin\psi_{1}+\sin\psi_{2})+\cos\psi_{1}-\cos\psi_{2})+\frac{1}{2}-\delta$ with a statistical deviation $\nu$.

Here, $\delta=\sqrt{\frac{1}{2m}\ln{\frac{1}{\epsilon_{CHSH}}}}$ and $\nu=\sqrt{\frac{(m+1)}{2(1-\frac{m}{n})m^{2}}\ln{\frac{1}{\epsilon_{QPQ}}}}$, $\epsilon_{CHSH}$ and $\epsilon_{QPQ}$ are negligibly small value.

Essentially, the result means that if the success probability of the local CHSH game for the set $\Gamma_{CHSH}$ varies in the range $[p_{max}-\epsilon p_{max},p_{max}+\epsilon p_{max}]$, where $p_{max}$ equals $\frac{1}{8}(\sin{\theta}(\sin\psi_{1}+\sin\psi_{2})+\cos\psi_{1}-\cos\psi_{2})+\frac{1}{2}$ and $\epsilon$ is the accuracy parameter, then the success probability of the game for the set $\Gamma_{QPQ}$ would vary in the range $[p_{max}-\epsilon p_{max}-\nu,p_{max}+\epsilon p_{max}+\nu]$.

Note that in Theorem 1, if $n$ is close to $m$, then $\nu$ is no longer guarranteed to be negligible. On the other hand, the choice $n\geq 2m$ makes the coefficient of $\frac{(m+1)}{m^{2}}\ln\frac{1}{\epsilon_{QPQ}}$ less than $1$ and thus is practically a good choice.

So far, the entire security analysis, including that of QPQ Yang and DI-QPQ Maitra , is performed under the assumption that the states provided by Alice are all identical. Indeed, when $n$ is infinitely large, Alice cannot have any advantage in non-uniformly biasing the states, as Bob selects the subset $\Gamma_{CHSH}$ uniformly randomly. However, when $n\gg 2m$, but finite, then Alice could inject more bias in the choice of her basis than the threshold $\sqrt{\frac{2\epsilon p_{max}}{\cos{\psi_{1}}}}$ (from Eq. (2)) for a few states and no bias for the remaining states and still she could pass the CHSH test by Bob. More formally, if she injects a bias $\epsilon^{\prime}_{A}$ in $r$ out of $n$ states uniformly at random, then it can be easily shown that to pass the CHSH test, the following condition is required.

[TABLE]

Thus, by choosing $r\ll n$, Alice can lift the threshold of $\epsilon^{\prime}_{A}$ much higher than that of $\epsilon_{A}$ and can also retrieve more number of keys if the corresponding states are selected for QPQ.

To resist this attack, Bob has to choose the minimum possible $n$, i.e., $n=2m$. Since Bob will take $m=m_{opt}$ as per our analysis in Section II.1, we have $n=2m_{opt}$.

One may think that the restriction on $n$ would limit Bob to know the key bits for all the positions of the database. This can be easily taken care of by allowing Alice and Bob to play the game repeatedly, each time corresponding to new sets of positions in the database, so as to cover all the positions for Bob.

IV Discussion and conclusion

In this current draft, we propose an upgradation of the device independent quantum private query protocol presented by Maitra et al Maitra . We actually modify the protocol for finite sample size. We identify that the suggested protocol in Maitra works perfectly in asymptotic limit. However, for practical implementation we always have to deal with finite sample size. This is why we motivated to upgrade the protocol Maitra for practical purpose. In this regard, we estimate the sample size for the local CHSH test in an optimal way. On other words, we search for a strategy which certify the states with high confidence in such a way that the number of samples required for the testing should be minimal. In this direction, we show that if we deal with the maximum success probability of the game for a given $\theta$, we can reduce the number of samples significantly. We also show that the information leakage to Alice depends on the accuracy parameter $\epsilon$. The order of information leakage is equal to the order of $\epsilon$ meaning the smaller the $\epsilon$ is, the better the security of the protocol.

V Appendix A: Lemmas and Proofs

Lemma 1**.**

(Serfling Serfling ) Let $\{x_{1},x_{2},\cdots,x_{n}\}$ be a list of values in $[a,b]$ (not necessarily distinct). Let $\overline{x}=\frac{1}{n}\sum_{i}x_{i}$ be the average of these random variables. Let $k$ be the number of random variables $X_{1},X_{2},\cdots,X_{k}$ chosen from the list without replacement. Then for any value of $\delta>0$, we have $\Pr\left[|X-\overline{x}|\geq\delta\right]\leq\exp\left(\frac{-2\delta^{2}kn}{(n-k+1)(b-a)}\right),$ where $X=\frac{1}{k}\sum_{i}X_{i}$.

Lemma 2**.**

( Lim , Corollary to Serfling Lemma) Let $\mathbb{X}=\{x_{1},x_{2}...x_{n}\}$ be a list of (not necessarily distinct) values in $[0,1]$ with the average $\mu_{\mathbb{X}}=\frac{1}{n}\sum_{i=1}x_{i}$. Let $\mathbb{T}$ be a subset of $\mathbb{X}$ of size $t$ with average $\mu_{\mathbb{T}}=\frac{1}{t}\sum_{i\in\mathbb{T}}x_{i}$. Let $\mathbb{K}$ be the remaining subset of $\mathbb{X}$ with size $k$ (i.e., $t+k=n$). If the average of the subset $\mathbb{K}$ is $\mu_{\mathbb{K}}=\frac{1}{n-t}\sum_{i\in\mathbb{K}}x_{i}$, then for any value of $\epsilon>0$, we have $\Pr\left(|\mu_{\mathbb{K}}-\mu_{\mathbb{T}}|\geq\sqrt{\frac{n(t+1)}{2t^{2}(n-t)}\ln{\frac{1}{\epsilon}}}\right)\leq\epsilon.$

Proof of Theorem 1:

Proof.

We define a random variable $Y_{i}$ as follows: $Y_{i}=1$, if $a_{i}\oplus b_{i}=x_{i}\wedge{y_{i}}$; 0 otherwise. Now, we choose a subset $\Gamma_{CHSH}$ of size $m$ and define $Y=\frac{1}{m}\sum_{i\in\Gamma_{CHSH}}Y_{i}$. Here, $Y$ is called observed average value. Let the expected value of $Y$ for that subset be $\mathbb{E}(Y)=\frac{1}{8}(\sin{\theta}(\sin\psi_{1}+\sin\psi_{2})+\cos\psi_{1}-\cos\psi_{2})+\frac{1}{2}$. Then applying Chernoff-Hoeffding bound (Proposition 1) we get $\Pr\left[|Y-\mathbb{E}(Y)|\geq\delta\right]\leq\exp(-2\delta^{2}m).$

Let $\epsilon_{CHSH}$ be a negligibly small value. Equating $\exp(-2\delta^{2}m)$ with $\epsilon_{CHSH}$ we can find the value of $\delta=\sqrt{\frac{1}{2m}\ln{\frac{1}{\epsilon_{CHSH}}}}$.

Again, we consider the remaining subset $\Gamma_{QPQ}$ of size $n-m$ and define $Y^{\prime}=\frac{1}{(n-m)}\sum_{i\in\Gamma_{QPQ}}Y_{i}$. Now, from Lemma 3, it can be shown that $\Pr(|Y-Y^{\prime}|\geq\nu)\leq\exp\left(\frac{-2m^{2}\nu^{2}(n-m)n}{(m+1)n^{2}}\right).$

Let $\epsilon_{QPQ}$ be a negligibly small value. Then, equating the R.H.S with $\epsilon_{QPQ}$, we get $\nu$. ∎